feat: Installation wizard with credential auto-discovery and guided setup

[ArtemisArchitect]

Problem

Setting up SWE-Squad requires manually creating .env, scavenging credentials from other services on the machine, guessing model IDs, and fixing the systemd service paths. The existing control-plane/deploy/install.sh only handles Node deps, typecheck, tests, and systemd install — it assumes .env is already fully configured.

During a fresh install we had to:

1. Manually find and copy GH_TOKEN from ~/.config/gh/hosts.yml
2. Manually copy API keys from ~/.hermes/.env (OPENAI_API_KEY, OPENAI_BASE_URL)
3. Guess the GitHub repo name (got it wrong)
4. Copy model names from .env.example that were stale vs what the proxy actually serves
5. Verify model IDs exist by hitting /v1/models and /v1/embeddings manually
6. Fix systemd service template paths (hardcoded paths, wrong npx path)
7. Create Python venv + install deps manually (install.sh only does Node)
8. Create data/swe_team/ directory manually
9. Discover Supabase creds were added by another session

Proposed Solution

Add an interactive installation wizard (scripts/ops/setup_wizard.py or extend install.sh) that:

Credential Auto-Discovery

• Scan ~/.config/gh/hosts.yml for existing gh auth tokens → prefill GH_TOKEN, SWE_GITHUB_ACCOUNT
• Scan ~/.hermes/.env for OPENAI_API_KEY / OPENAI_BASE_URL → prefill ANTHROPIC_AUTH_TOKEN, BASE_LLM_API_KEY/URL
• Scan existing .env files on the system for reusable credentials (Supabase, Telegram, etc.)
• Prompt only for values that cannot be auto-discovered

Model Validation

• Hit ANTHROPIC_BASE_URL/v1/models to list available models
• Hit BASE_LLM_API_URL/v1/embeddings to list/test embedding models
• Let user select from actual available models (not stale .env.example defaults)
• Validate model IDs work before writing to .env

Service Setup

• Detect correct npx/node paths (not assume /usr/bin/npx)
• Substitute all paths in service template (WorkingDirectory, EnvironmentFile, ExecStart)
• Create Python venv + install deps (currently missing from install.sh)
• Create data/swe_team/ directory
• Optionally: install_services.sh integration for Python legacy services

Guided Flow

$ bash control-plane/deploy/install.sh --wizard

=== SWE-Squad Setup Wizard ===

[1/8] GitHub credentials
  Found gh auth token for ArtemisArchitect. Use? [Y/n] y
  GH_TOKEN: ghp_...xxxx
  SWE_GITHUB_ACCOUNT: ArtemisArchitect
  SWE_GITHUB_REPO: [ArtemisArchitect/SWE-Squad] 

[2/8] LLM Proxy (api.ai-automate.me)
  Found API key in ~/.hermes/.env. Use? [Y/n] y
  Available models: glm-5-zai, glm-5.1-zai, gemma4-haiku, deepseek-v4-flash:cloud...
  Opus-tier model [glm-5-zai]: 
  Sonnet-tier model [glm-5.1-zai]: 
  Haiku-tier model [gemma4-haiku]: 
  Testing embedding models... qwen3-embedding (4096 dims) OK

[3/8] Telegram (optional — skip with Enter)
  TELEGRAM_BOT_TOKEN []: 
  TELEGRAM_CHAT_ID []: 

[4/8] Supabase (optional)
  ...

Acceptance Criteria

• install.sh --wizard (or separate wizard script) handles all credential discovery
• Model IDs validated against live proxy before writing
• No hardcoded paths in service template
• Python venv + deps created automatically
• data/swe_team/ created automatically
• Telegram is optional (can skip)
• Works on a fresh machine with only Node + Python + gh installed